diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml
index b9de759..4393f34 100644
--- a/.gitea/workflows/build.yml
+++ b/.gitea/workflows/build.yml
@@ -13,16 +13,17 @@ jobs:
       - name: Login to Gitea Registry
         uses: docker/login-action@v3
         with:
-          registry: git.schweitz.net
+          registry: git.schweitz.internal
           username: ${{ secrets.REGISTRY_USER }}
           password: ${{ secrets.REGISTRY_PASSWORD }}
 
       - name: Build and push
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v6
         with:
           context: .
           push: true
           provenance: false
+          sbom: false
           tags: |
             git.schweitz.internal/jpmschweitzer/tatlock:latest
             git.schweitz.internal/jpmschweitzer/tatlock:${{ github.ref_name }}
diff --git a/CHANGELOG.md b/CHANGELOG.md
index c592ef7..f6c7219 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.2.3] - 2025-12-14
+
+### Fixed
+
+- **CI**: Upgrade to build-push-action@v6, disable provenance and sbom for Gitea registry
+
 ## [1.2.2] - 2025-12-13
 
 ### Fixed
diff --git a/README.md b/README.md
index ab5ffaa..943b360 100644
--- a/README.md
+++ b/README.md
@@ -432,7 +432,7 @@ For LLM agent development guidelines and architectural decisions, see [AGENTS.md
 
 ## Version
 
-Current version: **1.2.2** - CI fix
+Current version: **1.2.3** - CI fix
 
 ---
 
diff --git a/pyproject.toml b/pyproject.toml
index 660fc52..38a3621 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "tatlock"
-version = "1.2.2"
+version = "1.2.3"
 description = "OpenAI-compatible API with Ollama backend"
 requires-python = ">=3.12"
 dependencies = []